Executive brief
RabbitMQ, a widely used message broker for handling data between applications, is vulnerable to a denial-of-service attack. An authorized user can send an excessively large message through the management interface, causing the server to run out of memory and crash. This can lead to service outages and disrupt the flow of data across your business infrastructure.
Technical details
A resource consumption vulnerability (CWE-400) exists in the RabbitMQ HTTP API because it does not enforce a limit on the size of HTTP request bodies. An authenticated attacker with sufficient permissions can publish a very large message via the API, leading to memory exhaustion. This typically results in the RabbitMQ node being terminated by the operating system's out-of-memory (OOM) killer. The vulnerability is reachable over the network and requires high privileges to exploit. Patches are available in versions 3.11.24 and 3.12.7.
Affected products
- RabbitMQ RabbitMQ >= 3.11.0, < 3.11.24; >= 3.12.0, < 3.12.7
Timeline
- 2023-10-23: advisory: Initial advisory published by RabbitMQ team
- 2023-10-25: disclosed: NVD publication date
- 2026-06-30: other: GitHub Advisory Database entry updated